[New Integration] Trellix ePO (On-Prem)

## 1. Summary
Collect security events, endpoint inventory, and compliance data from Trellix ePO on-prem into Elastic Security. Trellix ePO is the on-premises endpoint management and policy console; this integration brings its event tables and device inventory into Elastic via the ePO REST API (CEL) and optional syslog — for threat detection, audit, DLP, and host/asset context.

This is separate from the existing **Trellix ePO Cloud** package (`trellix_epo_cloud`). Out of scope: direct SQL/database polling of the ePO backend.

## 2. Vendor and product
Trellix ePO on-prem exposes event and inventory data through its REST API against fixed ePO tables. Syslog can also be forwarded from ePO for threat events.

- **Transport:** ePO REST API polled on a schedule (CEL); optional syslog over TCP/UDP. Nothing needs to be opened inbound for the API path.
- **Auth:** ePO API credentials (as configured in the on-prem console).
- **Deployment:** CEL-based API pull so it can run agentless. Collection is truly incremental — each poll fetches only new events. We query ePO tables directly via a known API endpoint and filters; users do **not** need to supply a saved query ID. We do not plan to poll the SQL database.

## 3. Data
CEL-based streams (each mapped to a fixed ePO table; no query ID from the user):

- **Threat Events** — `EPOEvents` (optionally join `EPExtendedEvent`).
- **Audit / User Actions** — `OrionAuditLog`.
- **Web Control Events** — `WP_EventInfo`.
- **DLP Incidents** — `UDLP_EPD_Incidents`.
- **Client / Product Events** — `EPOProductEvents`.
- **Systems** (endpoint inventory) — `EPOLeafNode`. Should map to host/asset entity fields so ePO endpoints merge with hosts seen elsewhere.
- **Software / Product Versions** — `EPOSystemProductVersionInfo`.
- **Agent Enforcement Status** — `MAEnforcementStatusView` (+ `MARebootPendingView`).
- **Compliance History** — `EpoRollup_ComplianceHistory`.
- **Removable Media / Device Events** — `EEFFDeviceAllEventsView`.

Syslog (separate stream — format differs from API/table events):

- **Threat Events (Syslog)** — syslog TCP/UDP. Collected as an active input, distinct from the CEL threat-events stream.

## 4. What we get
On-prem Trellix ePO activity and inventory in Elastic without depending on SQL access or customer-managed query IDs. Threat, audit, DLP, web control, and product events for detection and investigation; systems and software inventory for host/asset context; enforcement and compliance streams for posture. Syslog covers environments that already forward from ePO. Closes the gap for customers on ePO on-prem who today only have ePO Cloud coverage in Elastic.

## 5. Dashboards
A threat and security-events overview:
- threat events over time (API and/or syslog)
- malware / detection breakdown
- DLP incidents and web control activity
- audit / user actions
- recent-event tables for review

An endpoint and posture view:
- systems by agent and enforcement status
- software / product versions across the fleet
- compliance history and policy posture
- removable media / device events
- stale or non-reporting endpoints

## 6. References
- Related package: `trellix_epo_cloud` (cloud — separate product surface)
- Collection: CEL API pull (incremental) + syslog TCP/UDP; no direct SQL